EP2788913B1 - System zur verwaltung einer datenzentrumsinfrastruktur mit sicherheit für vorrichtungen mit verwalteter infrastruktur - Google Patents

System zur verwaltung einer datenzentrumsinfrastruktur mit sicherheit für vorrichtungen mit verwalteter infrastruktur Download PDF

Info

Publication number
EP2788913B1
EP2788913B1 EP12856500.9A EP12856500A EP2788913B1 EP 2788913 B1 EP2788913 B1 EP 2788913B1 EP 12856500 A EP12856500 A EP 12856500A EP 2788913 B1 EP2788913 B1 EP 2788913B1
Authority
EP
European Patent Office
Prior art keywords
managed infrastructure
engine
security
infrastructure devices
managed
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
EP12856500.9A
Other languages
English (en)
French (fr)
Other versions
EP2788913A4 (de
EP2788913A1 (de
Inventor
Bharat A. Khuti
Steven Geffin
James Robinson
Mario Costa
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Vertiv IT Systems Inc
Original Assignee
Vertiv IT Systems Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Vertiv IT Systems Inc filed Critical Vertiv IT Systems Inc
Publication of EP2788913A1 publication Critical patent/EP2788913A1/de
Publication of EP2788913A4 publication Critical patent/EP2788913A4/de
Application granted granted Critical
Publication of EP2788913B1 publication Critical patent/EP2788913B1/de
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/145—Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/577—Assessing vulnerabilities and evaluating computer system security
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
    • G06F11/3006—Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/3058—Monitoring arrangements for monitoring environmental properties or parameters of the computing system or of the computing system component, e.g. monitoring of power, currents, temperature, humidity, position, vibrations
    • G06F11/3062—Monitoring arrangements for monitoring environmental properties or parameters of the computing system or of the computing system component, e.g. monitoring of power, currents, temperature, humidity, position, vibrations where the monitored property is the power consumption
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/3065—Monitoring arrangements determined by the means or processing involved in reporting the monitored data
    • G06F11/3072—Monitoring arrangements determined by the means or processing involved in reporting the monitored data where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting

Definitions

  • the present application is directed to systems and methods for managing the infrastructure associated with data centers. More particularly, the present application is directed to systems and methods that provide real time security monitoring of managed infrastructure devices such as computer controlled computer room air conditioning (CRAC) systems, computer controlled power distribution subsystems (PDUs), and other managed infrastructure components that support data center devices such as servers, switches, routers, etc.
  • CRAC computer controlled computer room air conditioning
  • PDUs computer controlled power distribution subsystems
  • the real time security monitoring enables viruses, malware, and misuse to be detected, quarantined and/or removed to thus reduce the security risks affecting the managed infrastructure devices, which could potentially negatively impact the operation of a data center.
  • Modern data centers typically include a number of managed infrastructure devices that are used to provide cooling and power to the various servers, routers, switches and other data center components.
  • managed infrastructure devices may include computer room air conditioning (CRAC) units, power distribution units (PDUs) and other devices.
  • CRAC computer room air conditioning
  • PDUs power distribution units
  • Many of the managed infrastructure devices have progressed in sophistication to the point where they each include their own on-board computer or processor.
  • the computer or processor may communicate the operational status of the device and may be controlled by an independent subsystem.
  • the independent subsystem may be used to control operation of the CRAC units and PDUs, for example by shutting down a CRAC unit to save costs during periods where usage of the data center devices (i.e., servers, routers, etc.) is low.
  • the independent subsystem may be part of an overall data center infrastructure management (DCIM) system that manages all the data center devices such as servers, routers, processors, and network switches, and also enables remote access to the data center devices from remote terminals.
  • DCIM data center infrastructure management
  • WO 2007/016478 A2 discloses a security system to provide a defense from known and unknown viruses, worms, spyware, hackers, and unwanted or unknown software. The system can implement centralized policies that allow an administrator to approve, block, quarantine, or log file activities.
  • US 2011/0288692 A1 discloses a system for characterizing malicious activity in an intelligent utility grid system that includes a system storage in which to store a database including a plurality of rules.
  • a virus infected file or malware which infects an on-board computer of a CRAC unit, a PDU or any other managed infrastructure device, can potentially disrupt operation of the device, as well as potentially impact operation of other devices in the data center such as servers, PDUs, routers, etc. Having a virus or malware infect even just one CRAC unit could potentially result in the need to shut down an entire equipment row of servers. In some large scale data centers, this could involve shutting down dozens or even hundreds of servers.
  • the real time security scans would operate to detect security threats, to provide security notifications to IT personnel, and to quarantine or remove potential security threats that could affect the operation of highly important data center infrastructure devices.
  • a remote access appliance as defined in claim 12.
  • the present disclosure relates to a system for enhancing detection of a security threat to a managed infrastructure device operating within a data center.
  • the system may include a data center infrastructure management (DCIM) system for monitoring operation of the managed infrastructure device.
  • the DCIM system may include a remote access appliance for communicating with the managed infrastructure device.
  • the managed infrastructure device may include an on-board computer.
  • the remote access appliance may include an engine configured to detect if information to be communicated to the on-board computer of the managed infrastructure device poses a security threat to the managed infrastructure device.
  • the present disclosure relates to a system for enhancing detection of a security threat to managed infrastructure devices operating within a data center.
  • the system may include a data center infrastructure management (DCIM) system for monitoring operation of the managed infrastructure devices in the data center.
  • the DCIM system may include a remote access appliance for communicating with the managed infrastructure devices, where each of the managed infrastructure devices includes an on-board computer.
  • the remote access appliance may include a plurality of: a complex event processor (CEP) engine configured to be used for log collection for information relating to security threats; a discovery engine that includes at least one of custom definitions or algorithms that enable scanning for a security threat and identifying a security weakness in any one of the managed infrastructure devices; and a security detection engine configured to scan for and detect at least one of malware, or infected files, or infected folders, or infected processes associated with operation of any one of the managed infrastructure devices.
  • CEP complex event processor
  • the present disclosure relates to a method for enhancing detection of a security threat to a managed infrastructure device operating within a data center.
  • the method may include using a data center infrastructure management (DCIM) system to monitor operation of a managed infrastructure device in the data center.
  • DCIM data center infrastructure management
  • Using the DCIM system may include using a remote access appliance configured as part of the DCIM system for communicating with an on-board computer of the managed infrastructure device.
  • Using the remote access appliance may include using an engine having machine executable code adapted to run on a processor, to detect if information to be communicated to the on-board computer poses a security threat to the managed infrastructure device.
  • the system 10 may include a data center infrastructure management (DCIM) system which is identified by reference number 12.
  • the DCIM system 12 includes a remote access appliance 14, which in one embodiment may be a "Universal Management Gateway” ("UMG"), commercially available from Avocent Corp. of Huntsville, AL.
  • UMG Universal Management Gateway
  • the remote access appliance will be referred to throughout the following discussion as the "UMG 14".
  • the UMG 14 may be in communication over a wide area network (WAN) or possibly a local area network (LAN) with a client browser 16 of a remote computer 18 (e.g., desktop, laptop, tablet or possibly a smartphone).
  • the UMG 14 may be in communication with a plurality of managed infrastructure devices 20, 22 and 24 via IP (Internet Protocol) connections 20a, 22a and 24a, or possibly via serial connections. If IP connections are used, then the Liebert Corp. "Velocity" protocol may be implemented. Alternatively, the Modbus protocol, or any other suitable protocol, may also be used to communicate with the managed infrastructure devices 20, 22 and 24. While only three managed infrastructure devices 20-24 are shown, it will be appreciated that a greater or lesser quantity of such devices may be present. Still further, the UMG, while shown as part of the DCIM system 12, may be operated in a standalone mode (i.e., without being a part of the DCIM system 12).
  • the managed infrastructure devices may include computer controlled CRAC (computer room air conditioning) units, PDUs (power distribution units), and various other components that each have an on-board computer that communicates with the UMG 14.
  • CRAC computer room air conditioning
  • PDU power distribution units
  • a managed device may include a specific form of on-board computer known more commonly as a "service processor", that assists with monitoring important operational parameters (e.g., voltages, fan speeds, main processor utilization) associated with a managed device. Since the on-board computer of each of the managed infrastructure devices 20-24 is in communication with a computer network, whether directly or through the UMG 14, the managed infrastructure devices are potentially susceptible to viruses, malware and other security threats.
  • a virus that infects an on-board computer or processor of one of the managed infrastructure devices 20-24 could potentially adversely affect operation of one or more critical computing devices, such as one or more servers, routers, network switches, etc. If a CRAC unit is affected, then potentially a significant subsection of a data center, such as the servers in an entire row of equipment racks, could potentially be rendered inoperable. If more than one CRAC unit is affected with a virus or malware, then the possibility may exist that an entire data center could be affected. Accordingly, it will be appreciated that maintaining the managed infrastructure devices 20-24 free from security threats is an important consideration in managing a data center.
  • the UMG 14 may include a standalone security management console 14a in communication with one or more security engines or modules, each incorporating machine readable code executable on a processor, to accomplish security monitoring of the managed infrastructure devices 20-24.
  • One such engine is a complex event processor (CEP) engine 26.
  • Another security engine may comprise a discovery engine 28, and still another engine may comprise a security detection engine 30.
  • the standalone security management console 14a enables the user to have direct access to data collected by the UMG 14 and control over the UMG 14.
  • the CEP engine 26 may be used for log collection and correlation of stored patterns or sequences 26a that enable it to detect if information about to be sent to a managed infrastructure device 20-24 may be infected with a virus.
  • the CEP engine 26 may also include stored, predetermined rules 26b that enable it to evaluate information received by it from one of the managed infrastructure devices 20-24, and which allow it to detect if an abnormal operating condition has affected a given one of the managed infrastructure devices 20-24.
  • the CEP engine 26 may also include suitable pattern recognition software 26c that detects when CPU utilization or power consumption of a managed infrastructure device has changed beyond acceptable predetermined limits, thus possibly indicating that a virus or malware has affected the device's on-board computer or processor.
  • a discovery engine 28 may be employed with custom definitions or algorithms that enable it to scan for security threats and to identify security weaknesses in the managed infrastructure devices 20-24.
  • One such discovery engine may include an OEM or open source vulnerability scanner like Nmap ("Network Mapper”), which is an open source utility for network exploration or security auditing.
  • Nmap Network Mapper
  • the discovery engine 28 may also be able to scan specific network addresses to determine if a specific device has outdated software, or if a port has a common weakness like an SMB (Microsoft Server Message Block) or other network protocol vulnerability.
  • the discovery engine 28 may also identify whether a specific port of a managed infrastructure device is open when it otherwise should not be, thus possibly indicating that a security threat has arisen with the device.
  • the security detection engine 30 may be used to scan for and detect malware or infected files, folders or processes associated with operation of any of the managed infrastructure devices 20-24.
  • the security detection engine 30 could also be configured to prevent the downloading of potentially unsafe files from known malware URLs.
  • the security detection engine 30 may also identify and protect a given client's proprietary files or otherwise provide a notification that a proprietary file of a client has been moved or copied.
  • the security detection engine 30 may include its own database 30a or it may access a remote data base via a WAN (e.g., the Internet) or possibly via a LAN.
  • the security detection engine 30 may be an open source security engine such as OpenDLP, which is an agent-based, centrally-managed, distributable data loss prevention (DLP) tool.
  • OpenDLP is an agent-based, centrally-managed, distributable data loss prevention (DLP) tool.
  • the security detection engine 30 may also set safer configuration settings on devices like CRAC units, PDUs and other data center management systems, thus reducing the risk to the customer.
  • the security detection engine 30 may also be provided with the ability to scan all of the various types of managed infrastructure devices used in a data center. Alternatively, a plurality of different security detection engines 30 may be employed, with each one customized to handle a specific one of the managed infrastructure devices 20-24 (or possibly a specific class/type/model of managed infrastructure device). It is also possible for one, two or more of the engines 26, 28 or 30 to be assigned to a specific one of the managed infrastructure devices 20-24, in the event that operation of the specific managed infrastructure device is critical.
  • the engines 26, 28 and 30 may be independent modules (including software and potentially hardware components), it is possible that one or more of the engines 26-30 may be integrated into another event/alarm monitoring subsystem (not shown) of the DCIM system 12, or at least placed in communication with the other event/alarm monitoring subsystem. If any of the engines 26-30 are placed in communication with the other event/alarm monitoring subsystem, then the other event/alarm monitoring subsystem's generating and/or reporting capabilities could potentially be used to apprise other applications being used with the DCIM system 12 of security threats. It may also be advantageous to incorporate files, for example virus signature files, into the other event/alarm monitoring subsystem in the event it is being used to communicate with a managed infrastructure device.
  • files for example virus signature files
  • a Security Information and Event Management (SIEM) (using, as one example, the syslog protocol) server 32 (hereinafter "SIEM server 32") may also be in communication with the DCIM system 12 via a LAN connection or a WAN connection. It will be appreciated that other protocols besides the syslog protocol could just as readily be used with the SIEM server 32.
  • the SIEM server 32 may collect data (typically log files; e.g., event logs) into a central repository for trend analysis.
  • SIEM products generally comprise software agents (i.e., components) that may be running on the SIEM server 32.
  • the SIEM products may collect information about security related events and may display reports, charts and graphs of collected information.
  • the SIEM products may incorporate local filters to reduce and manipulate the data that is collected and logged by the SIEM server 32.
  • the data that is collected by the SIEM server 32 may be correlated, analyzed, and/or normalized, and/or aggregated as it is being recorded by the SIEM products running on the SIEM server 32.
  • the SIEM server 32 could be open source software or software available from various OEM companies such as NitroSecurity, Inc. (now part of McAfee, Inc.) of Portsmouth, NH, or ArcSight, L.L.C. (now part of Hewlett-Packard Company) of Cupertino, CA, or Symantec Corp.
  • a security management console 34 may also form part of the DCIM system 12.
  • the security management console 34 may be accessed via a LAN connection or via a WAN connection to enable an IT security individual to set policies, monitor and review security events, and initialize or schedule a scan of the managed infrastructure devices.
  • the security management console 34 may be used to look for security threats, set policies on alarm triggers and notifications, enable SIEM integration, and configure and manage a deployment of one or multiple engines 26, 28 and 30 on one or multiple UMGs 14 from a remote terminal 36.
  • the DCIM system 12 is modified to also include a proxy/brokering engine 38.
  • the proxy/brokering engine 38 effectively operates as a "connection" broker and allows safe and secure access to managed infrastructure devices like the CRAC units 20 and 22 and the PDU 24.
  • the proxy/brokering engine 38 further may act as a mediator to the managed infrastructure devices 20-24 by inspecting the communications with the managed infrastructure devices.
  • the proxy/brokering engine 38 may allow only safe and authorized communications outside of the DCIM system 12 or when the UMG 14 is operating in standalone mode.
  • Figure 3 also illustrates an optional implementation of a proxy/brokering engine 38a that allows a remote terminal to directly access the managed infrastructure devices 20, 24 and 26.
  • the system 10 may make a significant difference in ensuring that viruses, malware and other security threats do not affect the ongoing operation of a data center by attacking and compromising one or more managed infrastructure devices operating within the data center.
  • the system 10 enables prompt reporting of security threats or viruses, and also provides real-time scanning, detection and quarantining/removal of security threats that might otherwise be transmitted to the on-board computer or processor of a managed infrastructure device.
  • the system 10 is also able to detect when files have been copied or moved and to provide alerts as to these events.
  • a system for enhancing detection of a security threat that affects operation of managed infrastructure devices operating within a data center including: a data center infrastructure management (DCIM) system for monitoring operation of the managed infrastructure devices, the DCIM system including: a remote access appliance for communicating with the managed infrastructure devices, each of the managed infrastructure devices including an on-board computer; and the remote access appliance including a plurality of: a complex event processor (CEP) engine configured to be used for log collection of information relating to security threats; a discovery engine that includes at least one of custom definitions or algorithms that enable it to scan for security threats and to identify a security weakness in any one of the managed infrastructure devices; and a security detection engine configured to scan for and detect at least one of malware, or infected files, or infected folders, or infected processes associated with operation of any one of the managed infrastructure devices.
  • CEP complex event processor
  • the CEP engine includes a plurality of predetermined rules that enable it to evaluate information received by it from the managed infrastructure devices and to detect if an abnormal operating condition has affected any one of the managed infrastructure devices.
  • the CEP engine includes pattern recognition software that detects when at least one of central processing unit (CPU) utilization or power consumption of any of the managed infrastructure devices has changed beyond an acceptable predetermined limit, thus potentially indicating that a security threat has affected the on-board computer of one of the managed infrastructure devices.
  • CPU central processing unit
  • system further comprises a discovery engine including code executable on a processor that includes at least one of custom definitions or algorithms that enable it to scan for security threats and to identify a security weakness in any one of the managed infrastructure devices.
  • a discovery engine including code executable on a processor that includes at least one of custom definitions or algorithms that enable it to scan for security threats and to identify a security weakness in any one of the managed infrastructure devices.
  • the security detection engine includes code executable on a processor which is configured to scan for and detect at least one of malware, or infected files, or infected folders, or infected processes associated with operation of any one of the managed infrastructure devices.
  • the system further comprises a Security Information and Event Management (SIEM) server in communication with the DCIM system by at least one of a local area network connection or a wide area network connection, the SIEM server configured to collect data into a central repository for trend analysis.
  • SIEM Security Information and Event Management
  • the SIEM server includes a software component configured to collect information about security-related events and to display at least one of reports, charts and graphs of collected information concerning the security-related events.
  • a proxy/brokering engine configured to act as a mediator between the engines and the managed infrastructure devices to allow safe and secure access to the managed infrastructure devices by inspecting communications with the managed infrastructure devices.
  • system 10 has been described in connection with managed infrastructure devices operating within a data center, the system 10 could be implemented in other environments with little or no modification.
  • Other environments may potentially include factories and manufacturing facilities, warehousing facilities, health care facilities, military and government facilities, and virtually any other type of facility where the operation of a plurality of computer-controlled devices needs to be monitored to ensure against viruses, malware and other security threats that may compromise operation of the computer- controlled devices.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Alarm Systems (AREA)
  • Computer And Data Communications (AREA)

Claims (12)

  1. System (10) zum Verbessern einer Erfassung mindestens eines von Malware oder Viren, die versuchen, eine verwaltete Infrastrukturvorrichtung einer Vielzahl von verwalteten Infrastrukturvorrichtungen (20-24), die innerhalb eines Datenzentrums arbeiten, zu infizieren, das System enthaltend:
    ein Datenzentrumsinfrastrukturverwaltungs- "DCIM" (Data Center Infrastructure Management) -system (12) zum Überwachen von Betrieb einer Vielzahl verwalteter Infrastrukturvorrichtungen, das DCIM-System enthaltend:
    ein Fernzugriffsgerät (14) zum Kommunizieren mit den verwalteten Infrastrukturvorrichtungen, wobei jede verwaltete Infrastrukturvorrichtung einen On-Board-Computer enthält; und
    das Fernzugriffsgerät, das eine Engine enthält, die konfiguriert ist, zu erfassen, ob Informationen, die an den On-Board-Computer einer der verwalteten Infrastrukturvorrichtungen zu kommunizieren sind, eine Sicherheitsbedrohung für die verwaltete Infrastrukturvorrichtung darstellt,
    wobei die Engine eine komplexe Ereignisprozessor "CEP" (Complex Event Processor) Engine (26) enthält, wobei die CEP Engine aufweist:
    eine Vielzahl vorbestimmter Regeln (26b), die der CEP Engine ermöglichen, Informationen zu evaluieren, die von den verwalteten Infrastrukturvorrichtungen empfangen werden, um zu erfassen, ob eine abnormale Betriebsbedingung eine gegebene der verwalteten Infrastrukturvorrichtungen beeinträchtigt hat; und
    Strukturerkennungssoftware (26c), die erfasst, wenn mindestens eine Zentralverarbeitungseinheit-"CPU" (Central Processing Unit) -nutzung oder Stromverbrauch einer der verwalteten Infrastrukturvorrichtungen sich über eine akzeptable vorbestimmte Grenze hinaus verändert hat, wodurch potenziell angezeigt wird, dass ein Virus oder eine Malware den On-Board-Computer der verwalteten Infrastrukturvorrichtung beeinträchtigt hat.
  2. System nach Anspruch 1, wobei die CEP Engine konfiguriert ist, zur Protokollsammlung und Korrelation vorgespeicherter Strukturen oder Sequenzen (26a) verwendet zu werden, die der CEP Engine ermöglichen, zu erfassen, ob die Informationen, die an die verwaltete Infrastrukturvorrichtung (20-24) gesendet werden sollen, mit einer Sicherheitsbedrohung infiziert sind.
  3. System nach Anspruch 1, wobei die Engine eine Entdeckungs-Engine (28) aufweist, die mindestens eines von kundenspezifischen Definitionen oder Algorithmen enthält, die ihr ermöglichen, nach Sicherheitsbedrohungen abzutasten und eine Sicherheitsschwäche in der verwalteten Infrastrukturvorrichtung (20-24) zu identifizieren.
  4. System nach Anspruch 1, wobei die Engine eine Sicherheitserfassungs-Engine (30) umfasst, die konfiguriert ist, nach mindestens einem von Malware, oder infizierten Dateien, oder infizierten Ordnern, oder infizierten Prozessen, die einem Betrieb der verwalteten Infrastrukturvorrichtung (20-24) zugehörig sind, abzutasten und diese zu erfassen.
  5. System nach Anspruch 1, wobei die Engine eine Sicherheitserfassungs-Engine (30) aufweist, die für mindestens eines konfiguriert ist von:
    Verhindern eines Herunterladens potenziell unsicherer Dateien von bekannten Malware-URLs;
    Identifizieren und Schützen proprietärer Dateien eines gegebenen Kunden; und
    Bereitstellen einer Benachrichtigung, dass eine proprietäre Datei eines Kunden verschoben oder kopiert wurde.
  6. System nach Anspruch 1, wobei das Fernzugriffsgerät (14) in Kommunikation mit einer Sicherheitsverwaltungskonsole (34) steht, die konfiguriert ist, über mindestens eine einer Lokalnetzwerkverbindung oder einer Großraumnetzwerkverbindung zugegriffen zu werden, und wobei die Sicherheitsverwaltungskonsole einer Person ermöglicht, mindestens einen der folgenden Betriebe durchzuführen:
    Richtlinien für Betrieb der verwalteten Infrastrukturvorrichtung (20-24) einzustellen;
    Sicherheitsereignisse zu überwachen und bewerten, die die verwaltete Infrastrukturvorrichtung beeinträchtigen;
    eine Abtastung der verwalteten Infrastrukturvorrichtung zu initialisieren oder planen, um nach Sicherheitsbedrohungen zu sehen;
    Richtlinien für Alarmauslöser und Benachrichtigungen bezüglich der verwalteten Infrastrukturvorrichtung einzustellen; und
    einen Einsatz der Engine zu konfigurieren und zu verwalten.
  7. System nach Anspruch 1, ferner aufweisend einen Sicherheitsinformations- und Ereignisverwaltungs-"SIEM" (Security Information and Event Management) (32) -Server in Kommunikation mit dem DCIM-System durch mindestens eine von einer Lokalnetzwerkverbindung oder einer Großraumnetzwerkverbindung, wobei der SIEM-Server konfiguriert ist, Daten in ein Zentralarchiv zur Trendanalyse zu sammeln.
  8. System nach Anspruch 7, wobei der SIEM-Server eine Softwarekomponente enthält, die konfiguriert ist, Informationen über sicherheitsbezogene Ereignisse zu sammeln und mindestens eines von Berichten, Diagrammen und Graphen gesammelter Informationen betreffend die sicherheitsbezogenen Ereignisse anzuzeigen.
  9. Verfahren zum Verbessern einer Erfassung einer Sicherheitsbedrohung für eine verwaltete Infrastrukturvorrichtung (20-24) einer Vielzahl verwalteter Infrastrukturvorrichtungen, die innerhalb eines Datenzentrums arbeiten, das Verfahren enthaltend:
    Überwachen, durch ein Datenzentruminfrastrukturverwaltungs- "DCIM"-system (12), Betrieb der Vielzahl verwalteter Infrastrukturvorrichtungen im Datenzentrum;
    Kommunizieren, durch ein Fernzugriffgerät (14), das einen Teil des DCIM-Systems bildet, mit einem On-Board-Computer jeder der verwalteten Infrastrukturvorrichtungen; und
    Erfassen, durch eine Engine, die innerhalb des Fernzugriffgeräts angeordnet ist, ob Informationen, die an den On-Board-Computer einer der verwalteten Infrastrukturvorrichtungen kommuniziert werden, eine Sicherheitsbedrohung für die verwaltete Infrastrukturvorrichtung darstellen,
    Verwenden, von einer komplexer Ereignisprozessor "CEP" Engine (26), die in der Engine enthalten ist, die innerhalb des Fernzugriffgeräts angeordnet ist, einer Vielzahl vorbestimmter Regeln (26b), die der CEP Engine ermöglichen, Informationen zu evaluieren, die von einer der verwalteten Infrastrukturvorrichtungen empfangen werden, um zu erfassen, ob eine abnormale Betriebsbedingung bezüglich einer Hardwarekomponente einer gegebenen der verwalteten Infrastrukturvorrichtungen die verwaltete Infrastrukturvorrichtung beeinträchtigt; und
    Erfassen, durch Strukturerkennungssoftware (26c), die in der CEP Engine enthalten ist, wann mindestens eines von Zentralverarbeitungseinheit-"CPU" -nutzung oder Stromverbrauch einer der verwalteten Infrastrukturvorrichtungen sich über eine akzeptable vorbestimmte Grenze hinaus verändert hat, wodurch potenziell angezeigt wird, dass ein Virus oder Malware den On-Board-Computer der verwalteten Infrastrukturvorrichtung beeinträchtigt hat.
  10. Verfahren nach Anspruch 9, wobei die CEP Engine Protokollsammlung und Korrelation mindestens einer von vorgespeicherten Strukturen oder vorgespeicherten Sequenzen (26a) durchführt, um zu erfassen, ob die Informationen die an die verwaltete Infrastrukturvorrichtung (20-24) gesendet werden sollen, mit einer Sicherheitsbedrohung infiziert sind.
  11. Verfahren nach Anspruch 9, wobei die Engine zu verwenden ferner aufweist, mindestens eines zu verwenden von:
    einer Entdeckungs-Engine (28) mit mindestens einem von kundenspezifischen Definitionen oder Algorithmen, um nach Sicherheitsbedrohungen abzutasten und eine Sicherheitsschwäche in der verwalteten Infrastrukturvorrichtung (20-24) zu identifizieren; und
    eine Sicherheitserfassungs-Engine (30), um nach mindestens einem von Malware, oder infizierten Dateien, oder infizierten Ordnern, oder infizierten Prozessen, die Betrieb der verwalteten Infrastrukturvorrichtung zugehörig sind, abzutasten und diese zu erfassen.
  12. Fernzugriffgerät (14), konfiguriert zur Verwendung in einem Datenzentrum, um einen Betrieb verwalteter Infrastrukturvorrichtungen (20-24) innerhalb des Datenzentrums zu überwachen und zum Verbessern einer Erfassung mindestens eines von Malware oder Viren, die versuchen, eine der verwalteten Infrastrukturvorrichtungen zu infizieren, und wobei das Fernzugriffgerät konfiguriert ist, mit den verwalteten Infrastrukturvorrichtungen zu kommunizieren, und wobei jede der verwalteten Infrastrukturvorrichtungen einen On-Board-Computer hat, das Fernzugriffgerät enthaltend:
    eine Engine, die konfiguriert ist, Informationen, die an eine der verwalteten Infrastrukturvorrichtungen gesendet werden sollen, und Informationen, die von einer der verwalteten Infrastrukturvorrichtungen empfangen wurden, zu empfangen,
    wobei die Engine konfiguriert ist, die Informationen, die an eine der verwalteten Infrastrukturvorrichtungen gesendet werden sollen, zu analysieren, um zu ermitteln, ob die Informationen eine Sicherheitsbedrohung für den On-Board-Computer der verwalteten Infrastrukturvorrichtung darstellen,
    wobei die Engine ferner eine komplexer Ereignisprozessor "CEP" Engine aufweist, wobei die CEP Engine aufweist:
    eine Vielzahl vorbestimmter Regeln (26b), die der Engine ermöglichen, Informationen zu evaluieren, die von einer der verwalteten Infrastrukturvorrichtungen empfangen wurden, um zu erfassen, ob eine abnormale Betriebsbedingung eine gegebene der verwalteten Infrastrukturvorrichtungen beeinträchtigt hat; und
    Strukturerkennungssoftware (26c), die erfasst, wenn mindestens eines von Zentralverarbeitungseinheit- "CPU" -nutzung oder Stromverbrauch einer der verwalteten Infrastrukturvorrichtungen sich über eine akzeptable vorbestimmte Grenze hinaus verändert hat, wodurch potenziell angezeigt wird, dass ein Virus oder Malware den On-Board-Computer der verwalteten Infrastrukturvorrichtung beeinträchtigt hat.
EP12856500.9A 2011-12-06 2012-11-20 System zur verwaltung einer datenzentrumsinfrastruktur mit sicherheit für vorrichtungen mit verwalteter infrastruktur Active EP2788913B1 (de)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US201161567400P 2011-12-06 2011-12-06
PCT/US2012/066072 WO2013085717A1 (en) 2011-12-06 2012-11-20 Data center infrastructure management system incorporating security for managed infrastructure devices

Publications (3)

Publication Number Publication Date
EP2788913A1 EP2788913A1 (de) 2014-10-15
EP2788913A4 EP2788913A4 (de) 2015-07-29
EP2788913B1 true EP2788913B1 (de) 2019-10-23

Family

ID=48574777

Family Applications (1)

Application Number Title Priority Date Filing Date
EP12856500.9A Active EP2788913B1 (de) 2011-12-06 2012-11-20 System zur verwaltung einer datenzentrumsinfrastruktur mit sicherheit für vorrichtungen mit verwalteter infrastruktur

Country Status (4)

Country Link
US (1) US9661016B2 (de)
EP (1) EP2788913B1 (de)
CN (1) CN103975331B (de)
WO (1) WO2013085717A1 (de)

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102227693A (zh) 2008-10-21 2011-10-26 力登美洲公司 实现认知的电能管理的方法
US20160012231A1 (en) * 2014-07-08 2016-01-14 International Business Machines Corporation Computer security responsive to an operating environment
US9938019B2 (en) * 2015-05-21 2018-04-10 The Boeing Company Systems and methods for detecting a security breach in an aircraft network
US9912192B2 (en) 2015-06-22 2018-03-06 Iron Mountain Incorporated Power distribution visibility in data center environments
US11075804B2 (en) 2018-10-22 2021-07-27 International Business Machines Corporation Network modeling and device configuration based on observed network behavior
CN109582534B (zh) * 2018-11-01 2022-05-17 创新先进技术有限公司 系统的操作入口的确定方法、装置和服务器
US11695787B2 (en) 2020-07-01 2023-07-04 Hawk Network Defense, Inc. Apparatus and methods for determining event information and intrusion detection at a host device

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050278780A1 (en) * 2004-06-12 2005-12-15 Krishna Girish R System and method for monitoring processing in a document processing peripheral

Family Cites Families (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7127743B1 (en) * 2000-06-23 2006-10-24 Netforensics, Inc. Comprehensive security structure platform for network managers
KR100794136B1 (ko) 2000-06-30 2008-01-10 주식회사 케이티 원격 바이러스 검색 서비스 방법
US7761923B2 (en) * 2004-03-01 2010-07-20 Invensys Systems, Inc. Process control methods and apparatus for intrusion detection, protection and network hardening
CA2563422C (en) * 2004-04-15 2013-06-04 Clearpath Networks, Inc. Systems and methods for managing a network
US20060031934A1 (en) * 2004-08-04 2006-02-09 Stonewater Control Systems, Inc. Monitoring system
WO2007016478A2 (en) * 2005-07-29 2007-02-08 Bit9, Inc. Network security systems and methods
US20070058657A1 (en) 2005-08-22 2007-03-15 Graham Holt System for consolidating and securing access to all out-of-band interfaces in computer, telecommunication, and networking equipment, regardless of the interface type
US7852873B2 (en) 2006-03-01 2010-12-14 Lantronix, Inc. Universal computer management interface
US7890612B2 (en) * 2006-05-08 2011-02-15 Electro Guard Corp. Method and apparatus for regulating data flow between a communications device and a network
US20080295173A1 (en) * 2007-05-21 2008-11-27 Tsvetomir Iliev Tsvetanov Pattern-based network defense mechanism
US20100268818A1 (en) * 2007-12-20 2010-10-21 Richmond Alfred R Systems and methods for forensic analysis of network behavior
US20090260074A1 (en) * 2008-04-10 2009-10-15 Qlayer Nv System and method for application level access to virtual server environments
US20090297043A1 (en) * 2008-05-28 2009-12-03 International Business Machines Corporation Pattern scanner and editor for security audit systems
WO2009147631A1 (en) 2008-06-05 2009-12-10 Neocleus Israel Ltd Secure multi-purpose computing client
US8955107B2 (en) * 2008-09-12 2015-02-10 Juniper Networks, Inc. Hierarchical application of security services within a computer network
US8712596B2 (en) 2010-05-20 2014-04-29 Accenture Global Services Limited Malicious attack detection and analysis
US9047441B2 (en) * 2011-05-24 2015-06-02 Palo Alto Networks, Inc. Malware analysis system

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050278780A1 (en) * 2004-06-12 2005-12-15 Krishna Girish R System and method for monitoring processing in a document processing peripheral

Also Published As

Publication number Publication date
WO2013085717A1 (en) 2013-06-13
CN103975331B (zh) 2017-06-13
US20140366139A1 (en) 2014-12-11
US9661016B2 (en) 2017-05-23
CN103975331A (zh) 2014-08-06
EP2788913A4 (de) 2015-07-29
EP2788913A1 (de) 2014-10-15

Similar Documents

Publication Publication Date Title
EP2788913B1 (de) System zur verwaltung einer datenzentrumsinfrastruktur mit sicherheit für vorrichtungen mit verwalteter infrastruktur
US11936666B1 (en) Risk analyzer for ascertaining a risk of harm to a network and generating alerts regarding the ascertained risk
US10095866B2 (en) System and method for threat risk scoring of security threats
US9594881B2 (en) System and method for passive threat detection using virtual memory inspection
US9910981B2 (en) Malicious code infection cause-and-effect analysis
EP2835948B1 (de) Verfahren zur verarbeitung einer signaturregel, server und system zur intrusionsverhinderung
AU2016333461B2 (en) Non-intrusive digital agent for behavioral monitoring of cybersecurity-related events in an industrial control system
EP2645294B1 (de) System und verfahren zur verarbeitung von sicherer plattform-attestierung
CN113661693A (zh) 经由日志检测敏感数据暴露
US20150373038A1 (en) Cyber security monitoring system and method for data center components
US20070192867A1 (en) Security appliances
WO2010005545A1 (en) Techniques for agent configuration
EP3374870B1 (de) Bedrohungsrisikobewertung von sicherheitsbedrohungen
WO2014021871A1 (en) Pattern consolidation to identify malicious activity
WO2006138469A2 (en) Duration of alerts and scanning of large data stores
US20160110544A1 (en) Disabling and initiating nodes based on security issue
GB2381722A (en) intrusion detection (id) system which uses signature and squelch values to prevent bandwidth (flood) attacks on a server
CN112787985B (zh) 一种漏洞的处理方法、管理设备以及网关设备
CN109218315B (zh) 一种安全管理方法和安全管理装置
JP2006330926A (ja) ウィルス感染検知装置
EP4287051A1 (de) Anordnung und verfahren zur bedrohungserkennung in einem computer oder computernetzwerk
KR102267411B1 (ko) 컴플라이언스를 이용한 데이터 보안 관리 시스템
KR20230032463A (ko) 네트워크 보안 지원 방법 및 이를 이용하는 보안 지원 장치
Xu et al. Antivirus in the Network Cloud
GB2397479A (en) Intrusion prevention system suspending operation of a directive

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

17P Request for examination filed

Effective date: 20140512

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

AX Request for extension of the european patent

Extension state: BA ME

RA4 Supplementary search report drawn up and despatched (corrected)

Effective date: 20150625

RIC1 Information provided on ipc code assigned before grant

Ipc: G06F 11/30 20060101ALI20150619BHEP

Ipc: G06F 21/55 20130101ALI20150619BHEP

Ipc: G06F 21/57 20130101ALI20150619BHEP

Ipc: G06F 21/00 20130101AFI20150619BHEP

Ipc: H04L 29/06 20060101ALI20150619BHEP

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: EXAMINATION IS IN PROGRESS

RAP1 Party data changed (applicant data changed or rights of an application transferred)

Owner name: AVOCENT HUNTSVILLE, LLC

17Q First examination report despatched

Effective date: 20161223

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: GRANT OF PATENT IS INTENDED

INTG Intention to grant announced

Effective date: 20190415

RAP1 Party data changed (applicant data changed or rights of an application transferred)

Owner name: VERTIV IT SYSTEMS, INC.

GRAJ Information related to disapproval of communication of intention to grant by the applicant or resumption of examination proceedings by the epo deleted

Free format text: ORIGINAL CODE: EPIDOSDIGR1

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: EXAMINATION IS IN PROGRESS

GRAR Information related to intention to grant a patent recorded

Free format text: ORIGINAL CODE: EPIDOSNIGR71

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: GRANT OF PATENT IS INTENDED

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE PATENT HAS BEEN GRANTED

INTC Intention to grant announced (deleted)
AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

AX Request for extension of the european patent

Extension state: BA ME

INTG Intention to grant announced

Effective date: 20190913

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: DE

Ref legal event code: R096

Ref document number: 602012065155

Country of ref document: DE

REG Reference to a national code

Ref country code: AT

Ref legal event code: REF

Ref document number: 1194479

Country of ref document: AT

Kind code of ref document: T

Effective date: 20191115

REG Reference to a national code

Ref country code: NL

Ref legal event code: MP

Effective date: 20191023

REG Reference to a national code

Ref country code: LT

Ref legal event code: MG4D

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20191023

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200124

Ref country code: NO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200123

Ref country code: SE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20191023

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200224

Ref country code: BG

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200123

Ref country code: ES

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20191023

Ref country code: LV

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20191023

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20191023

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20191023

Ref country code: LT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20191023

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: HR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20191023

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200224

Ref country code: RS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20191023

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: AL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20191023

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

REG Reference to a national code

Ref country code: DE

Ref legal event code: R097

Ref document number: 602012065155

Country of ref document: DE

PG2D Information on lapse in contracting state deleted

Ref country code: IS

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20191023

Ref country code: LI

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20191130

Ref country code: CH

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20191130

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20191023

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20191023

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20191023

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20191120

Ref country code: MC

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20191023

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200223

REG Reference to a national code

Ref country code: AT

Ref legal event code: MK05

Ref document number: 1194479

Country of ref document: AT

Kind code of ref document: T

Effective date: 20191023

REG Reference to a national code

Ref country code: BE

Ref legal event code: MM

Effective date: 20191130

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SM

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20191023

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20191023

26N No opposition filed

Effective date: 20200724

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20191120

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: AT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20191023

Ref country code: BE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20191130

Ref country code: SI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20191023

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CY

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20191023

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20191023

Ref country code: HU

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT; INVALID AB INITIO

Effective date: 20121120

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: TR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20191023

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20191023

P01 Opt-out of the competence of the unified patent court (upc) registered

Effective date: 20230621

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: GB

Payment date: 20231127

Year of fee payment: 12

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: IT

Payment date: 20231122

Year of fee payment: 12

Ref country code: FR

Payment date: 20231127

Year of fee payment: 12

Ref country code: DE

Payment date: 20231129

Year of fee payment: 12